SIMPLIFYING XSS DETECTION WITH NUCLEI - A NEW APPROACH

Summary from the TLDR InfoSec newsletter

Traditionally, XSS vulnerabilities are difficult to detect with tools like Nuclei as the tester needs to write a complex set of matchers to check if the payload is reflected in the response. Nuclei headless mode allows testers to configure templates to mimic real user actions on a webpage. When combined with the waitdialog action, a template can be instructed to wait for a dialog box and a matcher can be configured to check if the expected message appears in the dialog. This also enhances accuracy as in the traditional method there's no way to ensure that the script was triggered.